[tanderson-ld]

Fixes #242

Bumps the Guava version embedded (shaded) in launchdarkly-java-server-sdk from 32.0.1-jre to 33.8.0-jre, the latest release on Maven Central. The issue asked for 33.7.2 or later, which is where CVE-2026-102554 is fixed; since the library is shaded and consumers cannot override it, going straight to the latest gives the most headroom before the next scanner finding.

Why the extra two dependencies: Guava 33.x stopped depending on jsr305 and checker-qual (it migrated its own nullness annotations to JSpecify). The SDK's source imports javax.annotation.Nonnull/Nullable and org.checkerframework.checker.nullness.qual.NonNull directly and had been getting those libraries transitively through Guava, so the bump alone breaks compilation. They are now declared explicitly in libraries.internal, pinned to the same versions Guava 32.0.1 supplied (jsr305 3.0.2, checker-qual 3.33.0). Both were already embedded and shaded in the released uberjar, so this keeps the jar contents the same rather than adding anything new.

Verification done locally:

• Guava 33.8.0-jre still ships Java 8 bytecode (class file major version 52), so the SDK's 1.8 source/target compatibility is unaffected. The SDK's Guava usage is all long-stable API (immutable collections, CacheBuilder, MoreExecutors, Joiner, ByteStreams).
• The rebuilt uberjar's META-INF/maven/com.google.guava/guava/pom.properties (the file Trivy reads) now reports 33.8.0-jre.
• Shaded javax/annotation and org/checkerframework class entries in the rebuilt uberjar exactly match the released 7.17.4 jar (38 and 422 entries respectively). The only addition is four shaded org/jspecify/annotations classes, Guava's new annotation dependency.
• OSGi manifest is semantically unchanged (same Import-Package/Export-Package sets; internal dependencies are not declared there), and pom.xml is unchanged since internal dependencies are excluded from it.
• Full unit test suite passes.

---

Note

Overview
Updates the embedded (shaded) Guava in launchdarkly-java-server-sdk from 32.0.1-jre to 33.8.0-jre so the default uberjar addresses CVE-2026-102554 (fixed in Guava 33.7.2+). Because consumers cannot override shaded deps, the bump targets the latest release on Maven Central.

Guava 33.x no longer pulls in jsr305 or checker-qual (nullness moved to JSpecify), but server SDK sources still import javax.annotation.* and Checker Framework nullness types that previously came transitively through Guava. The build now declares and pins jsr305 3.0.2 and checker-qual 3.33.0 in libraries.internal so compile and shading keep working with the same annotation classes as before.

^{Reviewed by Cursor Bugbot for commit af70c32. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tanderson-ld]

For reviewers:

Guava 33.x dropped its jsr305 and checker-qual dependencies (it moved to JSpecify), and the SDK's own source imports those annotations and had been getting them transitively. I added both to libraries.internal pinned to the exact versions Guava 32.0.1 supplied (jsr305 3.0.2, checker-qual 3.33.0, they were already embedded and shaded in the released uberjar, so the jar contents stay the same rather than gaining anything new.